Summary
ConnectWise is investigating an active campaign in which attackers use compromised ScreenConnect environments at managed service providers (MSPs) to deploy rogue remote-access clients to customer devices. Huntress, which discovered the activity, says it abuses legitimate functionality rather than a software vulnerability. The campaign was still spreading when reported on November 11, 2026.
Scope
- 6 MSPs compromised and 286+ endpoints across 47 organizations per Huntress, with counts still rising.
- ConnectWise disabled five third-party extensions across about 400 partner environments as a precaution.
- Sequential attacker-assigned tags suggest other MSPs may have been breached earlier.
How the Attack Works
Attackers use ScreenConnect's Run Command feature to install rogue ScreenConnect clients on managed devices, giving them access outside the MSP's own environment. Custom tooling is sometimes compiled on the victim machine.
Huntress has not determined how attackers first get into MSP environments. Its telemetry points to compromised credentials or hijacked operator sessions. Huntress also warned of possible compromise of technician workstations during interactive sessions with infected devices; ConnectWise says those reports are still being confirmed, and how the spread from endpoint to technician is happening has not been explained.
Extensions Disabled by ConnectWise
ConnectWise handled cloud-hosted environments. On-premises customers must disable these manually:
- Labtech Plus
- RMM Plus
- RMM+
- RMM Plus Password Link
- RMM+ Password Link
Do not re-enable or reinstall them until ConnectWise issues further guidance. Disabling the extensions does not remove malware, persistence, or access already established on endpoints.
Indicators of Compromise
| Type | Value |
|---|---|
| Attacker relay | 185.99.255[.]28 |
| C2 domains | newnewnew.gotdns[.]org, soxnewwork.homedns[.]org |
| Possible additional C2 | cdn007-digitaldownloads[.]com |
| Secondary C2 | sc.payproofkit[.]com (155.94.150[.]39) |
| Stager | hxxps://ns.mo7sen[.]dev/EadF.php?p=4 |
| Rogue client IDs | 2588ef5c15954b10, ed630cc2c873b091 |
| Installer pattern | /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited<N> |
| Files | Panel-Lateral.ps1, runnew.cmd, ToolboxRelayUploader.exe, Run-Lateral-Full.bat |
The attacker name seen in the environment is Addmin.
Possibly Related Earlier Activity
BleepingComputer found a batch script, SSA-2026-STATEMENT-15518787.bat, posing as a Social Security Administration statement and first uploaded to VirusTotal on July 25, 2026. It adds Defender exclusions, persists via the Startup folder and Run key, downloads ScreenConnect installers, checks for rogue client ID ed630cc2c873b091, and reports to attackers via Telegram. The link to the current campaign is unclear, and Huntress declined to comment.
Recommended Actions
- Disable the five extensions above on any on-premises ScreenConnect server.
- Review authentication logs, extension installation records, administrative activity, Run Command history, and Toolbox records.
- Hunt endpoints for the rogue client IDs, relay IP, and C2 domains listed above.
- Avoid starting interactive ScreenConnect sessions with potentially compromised devices; investigate with separate security tooling.
- Rotate credentials for ScreenConnect operators, enforce MFA, and review active sessions.
- MSPs should notify affected customers promptly.